MTN Customer Information Privacy Notice 
1. MTN's enhancement fo your Privacy 


MTN (Proprietary) Limited with Registration Number: 1993/001411/07 ("MTN") and 
or any additional MTN legal entity (comprising joint ventures or subsidiaries where 
we have the controlling interest or operational control, which shall be deemed to be 
included whenever MTN is referenced), respects the privacy of your personal 
information which should be protected through the use and interaction with this 
website (www.mtn.co.za) and all our associated websites, mobile applications, 
products and services. 


We have prepared this Customer Information Privacy Notice ("Fhis Notice") Fo notify 
you of the type of personal information we collect From you, how we will treat that 
personal information and the circumstances under which we will share if with third 
parties. 


2. Who is a customer? 


A customer is a natural person or an organisation who enters a contract with us for 
the receipt of services or products, For his, her or ifs own use (as part of an integrated 
solution provided by us). 


An organisation customer could be: 


e authorised corporate administrators managing the corporate account 

e a corporate user — an employee of the organisation which has concluded a 
master services agreement with us 

e corporate consumers (the authorised Family members of a corporate user). 


Representatives of an organisation, who act on behalf of an organisation may only 
transact on our websites, mobile applications, products and services with 
authorisation From the organisation. 


Customers who are natural persons must be 18 years or older. IF you are under 18 
years, you may only use our websites, mobile applications, products, and services 
with the assistance of a parent or guardian who has given you, their consent. 


3. Who is a user? 


A user is a natural person member of an organisation) who uses our websites, mobile 
applications, products, and services. We distinguish between a user and a customer 
as on occasion someone will access our websites and will not yet be or become a 
subscribed customer. If may also be a user authorised by an organisation who has 
concluded a master services agreement with us. 


4. Consent From you 


We will not collect or process your personal information without obtaining your 
consent. Your consent is obtained in terms of a legally binding agreement, which 
includes the applicable commercial terms and conditions, website, mobile 
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applications terms and conditions and this Notice (for example, MTN Subscriber 
Agreements, Pre-paid terms and conditions, Post-paid Subscriber Agreement, 
product and promotion terms and conditions, Master Services/Reseller Agreements 
and Registrations or signing up of any of our online services and products and this 
Notice). 


By accepting the above-mentioned terms and conditions, you are accepting the 
terms and conditions of this Notice and provide us with consent for the processing of 
your personal information and accepting the practices described in this Notice. 


Should we ever wish to process any more than the minimum personal information 
needed to provide you with your product or service as mentioned in clause 6, we will 
ask you for your prior consent. 


Your consent may be changed according to clause 10 and clause 11. 


Should we ever wish Fo process any minor’s personal information, we will obtain your 
prior written consent as the parent or guardian, whichever is applicable. 


The only time we will ever process any personal information without your consent is 
where the law clearly requires us Fo do. 


5. Who does this Notice apply to? 
This Notice applies to: 


e all customers and/or users who are natural persons; and 
e all customers and/or users who are organisations. 


6. What we collect about you? 


We will always only collect exactly what we need directly from you, subject to 
exceptional lawful circumstances which are also further elaborated in our PoPI 
Manual mentioned in clause 4, For us to provide you with the product and or service, 
which you have requested us to provide. 


We will also advise you if any personal information to be provided is voluntary or not 
and what will occur if we cannot process any of the personal information requested. 


On some websites, mobile applications, products and services which you are 
subscribing Fo and or purchasing, you may be requested to provide your personal 
information which is relevant fo the type of services and or products being applied 
For. 


In general, personal information is information which identifies you as an individual 
or your organisation, such as: your First and last name, your organisation’s name and 
its directors’ names; your ID number or the organisation’s registration details and 
directors ID numbers; phone numbers; credit vetting and payment information and 
your, or the organisation’s communication preferences. 
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Personal information is information which identifies you as an individual and or the 
representatives or directors of an organisation, which includes - 


e Information relating Fo the race, gender, sex, pregnancy, marital status, 
national, ethnic, or social origin, colour, sexual orientation, age, physical or 
mental health, well-being, disability, religion, conscience, belief, culture, 
language, and birth of that person. 

e Information relating to the education or the medical, Financial, criminal or 
employment history of the person. 

e Any identifying number symbol such as cell phone number, account number, 
handset code, e-mail address, physical address, telephone number, location 
information, online identifier, or other assignment fo the person. 

e The biometric information of the person, which while processed, is not stored, 
but encrypted and securely transmitted to Home Affairs for real time 
verification of the person. 

e The personal opinions, views, or preferences of the person. 

e Correspondence sent by the person that is implicitly or explicitly of a private 
or confidential nature or further correspondence that would reveal the 
contents of the original correspondence and the views or opinions of another 
individual about the person. 


Whilst you are making use of any of our websites or mobile applications, we 
automatically collect certain personal information such as: your IP address; browser 
type; operating system; mobile carrier; your ISP, URLs of sites From which you arrive 
or leave the website and; mobile applications and sites that have our platform 
technology embedded. Through cookies and other technologies, we can recognise 
you as an existing or registered user of our website and/or mobile application and 
are able to better service you as a result. 


A cookie is generally a tiny data file that resides on your computer, mobile phone, or 
other device, and allows us to recognise you as a user when you return to our online 
store website using the same device and web browser. 


There are different types of cookies. Here are two examples: 


A "persistent" cookie - this cookie is set once you've logged onto a website. The next 
time you visit the website, Fhe persistent cookie will allow the website Fo recognise 
you as an existing user or registered user, so you will not need to log in before using 
the services. However, if you wish to access or change any of your payment 
information (like a credit card number) or your registered information, you must log 
in securely again with your password, even if your device contains a persistent 
cookie. 


A "session" cookie - this cookie is used to identify a visit to a website. Session cookies 
expire after a short time or when you close your web browser. 


You can remove or block cookies using the settings in your browser, but in some 
cases doing so may impact your ability to use the website. 
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Our MTN App’s widget solution makes use of location-based data to enable prepaid 
customers to take up the MTNZone location-based discounts. To use the widget 
Functionality, you must First accept that your location data will be used by MTN to 
provide you with the MTN Zone service. The location updates are automated on your 
device’s widget when you download the MTNApp and activate the widget Function. 


Should you object to the processing of location-based data by declining to activate 
the widget, MTN will not be able Fo provide you with the MTNZone discounts. This 
location-based data is used exclusively for the purpose of enabling the widget 
functionality needed for location-based discounts (MTNZone Service). Access Fo such 
information is strictly limited Fo Fhe systems and platforms integrated to one another 
to enable the MTNZone Service. Aggregated reports are made available to enable 
analysis of Fhe MTN Zone products performance to better service you. 


7. The use of your personal information 


To provide you with the best online services, mobile applications, products and 
services, we will use your personal information to: 


e Carry out a credit check if you're applying for a contract for products and or 
services and, to assess your application. 

e Validate that you are who you say you are by conducting a biometric 
verification process (upon application and at other times that your 
identification requires verification) which in some instances may not recognise 
your prints due fo Fhe nature of your day fo day activities (where you use your 
hands extensively so that it affects your finger prints) and is not therefore an 
indication that your biometric information has been inappropriately 
processed, and an alternative validation process will be applied. 

e Process the products and services you've bought from us, and keep you 
updated with your order progress. 

e Provide the relevant service or product to you. This includes other services not 
included in your agreement with us, and services that use information about 
where you are when using your mobile equipment (location information) and 
to contact you with messages about changes Fo the service or product. 

e Bill you For using our products or services. 

e Protect our network and manage the volume of calls, texts and other use of 
our network. For example, we identify peak periods of use, so we can try and 
ensure the network can handle the volume at those times. 

e Understand how you use our network, products and services. That way, we 
can develop more interesting and relevant products and services, as well as 
personalise the products and services we offer you. 

e Carry out research and statistical analysis to monitor how you use our 
network, products and services on an anonymous or personal basis. 

e Conduct market research and perform statistical analyses of your' behaviour. 
By being aware of your interest in and use of the various areas of our websites, 
mobile applications, products and services for us to better serve you. 
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Share information across our different business units For processing to serve 
you more efficiently such as, but not limited to, the Credit Vetting Process, 
Direct Marketing Process and Customer Loyalty Processes. 

Share information with our third parties within our operations where we have 
an underlying contractual relationship with the third parties to provide a 
service Fo you on our behalf. 

Prevent and detect fraud, information security and privacy incidents and other 
crimes, recover debts or trace those who owe us money. 

Send you promotional materials or details by SMS, e-mail, postal service, or 
electronic communication provided you have given your consent to receive 
such marketing From us or our authorised third parties. 

Let you know about other companies' products and services (including offers 
and discounts we've specially negotiated for you) Fhar we think may interest 
you, if you've chosen to receive this information. 

Contact you in the event of a query and respond to any questions or concerns 
you may have about using our network, products, or services. 

Act in accordance with circumstances prescribed by law. 


8. The safeguards for your personal information 


Maintaining the security of your personal information is important Fo us. Reasonable 
security safeguards have been implemented to protect your personal information. 
We use various methods to protect your information such as: 


Encryption methods when transmitting payment information, such as your 
credit card information. An icon resembling a padlock is displayed on the 
bottom of most Internet browser windows during encrypted transactions. 
Access to your personal information on our websites, mobile applications, 
products and services will be password-protected. 

Sensitive data (such as credit card information) is protected by SSL (secure 
sockets layer) encryption when it is exchanged between your web browser and 
our website and mobile applications. 

To protect any data, you store on our servers, we also regularly audit our 
systems For possible vulnerabilities and attacks. 

We maintain an Information Security Programme internally Fo ensure that 
your personal information is protected against unauthorised access, 
accidental loss, or destruction. 


9. Sharing of your personal information 


We do share your personal information with third parties where it is necessary to 
perform certain Functions to provide our services to you. We will only share your 
information in the Following instances: 


where disclosure is made with your consent; and 
where we are obliged to disclose information as required by law, without 
consent. 
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There may be circumstances where we are obliged to disclose your information by 
law and are prohibited From informing you when we have received a request For your 
personal information in relation to any suspected or alleged criminal activity. 


In addition, third parties chosen by us are assessed to ensure that they handle your 
information securely. Third parties are companies which we employ to perform 
Functions on our behalf. Some of our third parties perform the Following Functions: 


e Receiving payments, fulfilling orders, delivering packages, sending postal mail 
and email, removing repetitive information from customer lists, analysing 
data, providing market assistance, providing search results and links 
(including paid listings and links), processing credit card payment, and 
providing customer service such as assisting in upgrading customer contracts, 
conducting direct marketing activities subject Fo compliance with the laws 
relating Fo consent. 

e By performing online services on our websites, applications, products and 
services. 


These third parties have access to personal information needed to perform their 
Functions but may not use it For any other purposes that have not been clearly defined 
by us. 


We shall not transfer your personal information Fo a country or territory outside of 
South Africa unless that country or territory ensures an adequate level of protection 
of such personal information in relation to Fhe processing of personal information as 
adopted within South Africa and unless an agreement setting out the terms and 
conditions of securing the integrity and protection of data commensurate to South 
African legislation is concluded between us and the third party to which the personal 
information is transferred. 


Similarly, this third party may not transfer your personal information to another third 
party within that country or territory if they need to do so as part of their processing 
which they are authorised to do on our behalf, without our prior written authorisation. 
This will ensure that all authorised third parties apply fhe same level of data security 
and protection as we do for you. 


10. Your information choices 


Note: the processes referred to in 10 below apply indirectly to corporate users. IF you 
are a corporate user, you must go through your authorised corporate representative 
who will engage with MTN on your behalf, subject to the corporate’s approval. 


10.1 Accessing and changing your information 


You can review the personal information which you provided to us using Fhe MyMTN 
application and make any necessary changes to the information you have provided, 
subject to if not impacting our continued ability Fo deliver your products and services 
which you have mandated us fo provide. 
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Alternatively, you can call Fhe contact centre on 135 (iF using an MTN number) or 
submit requests making use of the contact Form on our websites. 


The Information Regulator requires the process to confirm that we have records 
containing your personal information, to be formalised. You will be advised in writing 
of how to go about the process of requesting access to and or updating your 
information once you have contacted us. 


Please be aware that even after your request for a change is processed, we may, for 
a time, retain residual information about you in its backup and/or archival copies of 
its database. 


10.2 Right to request copies of your personal information on record 


You are entitled fo request us to confirm what personal information we have on 
record of you at no cost. This will be completed within a reasonable timeframe, 
subject to any restrictions imposed by the Promotion of Access to Information Act. 


Thereafter you may request copies of these records if you need to see them 
physically. They will be provided in electronic Format. IF you wish to receive them in 
hard copy, we will be obliged to quote in advance how much if will cost you and you 
will need to confirm this in writing before we will process the request, again within a 
reasonable period. 


10.3 Right to object to processing 


Once you have confirmed what personal information we have on record of you, you 
are entitled Fo object to us processing any personal information and can Follow the 
same process mentioned above. You will be advised of whether it is possible to cease 
with the processing subject to the fact that we may need fo tell you that it means that 
we cannot continue to provide you with your product or service. For example, if you 
no longer wish us to have access to your bank details, fhen we will not be able to 
complete a monthly product or service fee debit order, which means we will have to 
cancel your product or service subject to the cancellation rules contained in your 
contract Ferms and conditions. 


10.4 Deletion or destruction of your Information 


You may request that we delete and or destroy any of your personal information 
provided, that you have finalised your relationship with us, meaning your contract 
has come to an end and you are no longer using our products or services. We will 
however retain and use your personal information for as long as is necessary to 
comply with our legal and business obligations, resolve disputes and enforce this 
Notice. The same process as mentioned above will be Followed with all requests being 
confirmed in prescribed formats as required by Fhe Information Regulator and we will 
provide you with a certificate of compliance at the end. 


10.5 Direct Marketing 
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You have the right to choose whether you wish fo receive marketing material or not. 
We may send you marketing material on related services, products and offerings 
provided by us or authorised third parties from time to time, subject Fo your having 
consented to receiving it af Fhe point of your first engaging with us or the authorised 
third party. We will always provide you with the option to opt out of receiving such 
direct marketing at the subsequent points of communicating. 


On occasion if we wish Fo market a new product or service and we have no record of 
your consent preferences, we or our authorised third party will contact you once to 
establish this and update our records. 


Should you have opted in to receive any marketing and you change your mind at any 
time, you are always able to opt out by making use of: 


e MyMTN application, or 

e the USSD menu at *135#, 

e or making use of our contact centre (via an online contact form or calling fhe 
contact centre at 135 if from an MTN number or 083 135 if not) Note: this 
option will not be a real time update. 


Please note, if you are a member of a corporate and they own your contract, if is the 
prerogative of the corporate who holds the master services agreement with us, to 
determine what direct marketing may be permitted to be sent to its users. 


We offer wireless application service provider (WASP) services to third parties and 
they are responsible For ensuring that the rules of direct marketing are complied with. 


We do comply with the direct marketing provisions of Fhe Consumer Protection Act 
No 68 of 2008 ("CPA") and the regulations. In terms of the CPA and ICASA 
Regulations, we are mandated to send you certain messages for example contract 
expiry notifications and data depletion notifications. These messages do not 
constitute direct marketing. 


10.6 Right to lodge a complaint 


You may lodge a complaint about how we have processed your personal information 
with Fhe Information Regulator at these contact details and making use of Form 5 





Website URL: | https://www.justice.gov.za/inforeg/index.html 
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 
Email: complaints.IR@justice.gov.za 























11. Your obligations 


You have certain obligations. Some of these obligations are imposed by applicable 
law and regulations, and others have become commonplace for us: 


e You must, always abide by the terms and conditions of this Customer 
Information Privacy Notice which may be updated From time to time and any 
agreement relating to our products and services that you have subscribed to. 
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This includes respecting all intellectual property rights that may belong to third 
parties (such as trademarks or photographs). 

You must not download or otherwise disseminate any information that may be 
deemed to be injurious, violent, offensive, racist or xenophobic, discriminates 
against people on the basis of gender and sexual orientation, threatens the 
rights and safety of others, or which may otherwise violate our purpose and 
spirit and our community of users on our websites and/or mobile applications. 
You must not provide us with information that you believe might be False or 
misleading. You must keep your username and password confidential and not 
share it with others. This particularly relates to any minors or partners who 
may get access to your device. 


12. Reporting incidents 


Please let us know via the abovementioned channels of communication: 


IF you believe your MTN website and/or mobile application account has been 
compromised. 

IF you have been contacted by someone about your MTN websites, mobile 
applications, products and services account asking for a password, birth date 
or other personal information. 

IF you believe your personal information has been used For Fraudulent activity. 
IF you are a member of the security community and need to report a technical 
vulnerability. 

IF you have any other enquiry relating to information privacy and security. 


13. Right to amend this Notice 


MTN may, at any time, change this Notice by posting the amended Notice on 
www.mb[n.co.za. Unless otherwise stated, the current version will apply each time you 
access this website. 


14. Date of Publishing 


Last updated 17 September 2021 
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